there isn't another alternative for protecting downloadable files except for storing them outside the site root
if it is above the site root, and someone where to guess the location and file name, they could access it without paying.
I would still use eCart for the memberships, just when the membership period is over, they need to re purchase.